Azure Web and Mobile built-in role

Azure Spring Cloud Service Registry Contributor

Reads, writes, and deletes user-application registration information in the managed Spring Cloud Service Registry through DataActions only. It does not manage the Azure Spring Apps resource through the control plane. Azure Spring Apps retires on March 31, 2028.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (3)

• Microsoft.AppPlatform/Spring/eurekaService/read
• Microsoft.AppPlatform/Spring/eurekaService/write
• Microsoft.AppPlatform/Spring/eurekaService/delete

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the existing Azure Spring Apps service instance containing the managed Service Registry. A parent-scope assignment is inherited by registries in additional instances, while service-instance scope bounds registration changes to one retiring deployment.

Common use cases (2)

• Allow an external Spring Boot application, service principal, managed identity, or migration tool to register with and update the managed Service Registry using Microsoft Entra token authentication.
• Change or remove registrations during a controlled migration from an existing Basic or Standard Azure Spring Apps deployment.

Prerequisites (2)

• An existing Basic or Standard Azure Spring Apps instance must expose the managed Service Registry endpoint; applications running inside the service are normally wired automatically with platform-managed certificates.
• The external principal must obtain a Microsoft Entra token, and the registration change must support an approved operational or migration workflow.

Best practices (3)

• Use Service Registry Reader when the principal only inspects registered applications.
• Assign directly on the service instance, protect service-principal credentials, and remove the role when the external registration or migration workflow ends.
• Move service discovery to a supported replacement before Azure Spring Apps retires on March 31, 2028.

Security considerations (3)

• The role can write and delete application registration information used for service discovery, potentially changing which service instances clients discover or disrupting discovery.
• It combines read and mutation authority over the Service Registry data plane even though it cannot manage the Azure Spring Apps resource itself.
• A parent-scope assignment extends registration mutation authority across every inherited Spring Apps instance.

Assignment guidance

Assign the Service Registry Contributor directly on the existing Azure Spring Apps service instance to the external application or migration identity that must write registrations. Use Reader for observation, document the migration deadline, and remove the assignment after service discovery moves to the replacement platform.

Related roles (1)

• Azure Spring Cloud Service Registry Reader: Provides read access to registered-application information without write or delete DataActions.

Editorial sources (7)

• Azure built-in roles for Web and Mobile - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Access Config Server and Service Registry →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure Spring Apps retirement announcement →

  Supports: Description, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →